马尔科夫模型在网络流量分类中的应用与研究  

Application and Research of Markov Model in Network Traffic Classification

作　　者：赵英 韩春昊 ZHAO Yinga;HAN Chunhaob(a. Information Cente;b. College of Informatica Science and Technology Beijing University of Chemical Technology,Beijing 100029, China)

机构地区：[1]北京化工大学信息中心,北京100029 [2]北京化工大学信息科学与技术学院,北京100029

出　　处：《计算机工程》2018年第5期291-295,共5页Computer Engineering

基　　金：中央高校基本科研业务费专项资金(PT1612)

摘　　要：传统的端口号与深度包检测分类技术已不能满足网络中各类应用的分类要求,无法进行准确分类。为此,提出一种基于半监督学习的马尔科夫模型网络流量分类算法。利用流之间的相关性构建马尔科夫模型,采用密度计算的方法估计聚类的中心点,通过KL距离计算中心点与样本之间的相似度,将样本划分到不同的应用类型中。使用马尔科夫模型提取特征参数,用以识别流量应用类型,并提高准确度,解决传统的基于半监督学习的流量分类方法依赖不稳定聚类算法的问题。实验结果表明,使用该方法机器学习得到的网络流量分类器可以取得理想的分类效果。With the development of information science and technology,the traditional port number and depth packet detection classification technology can not meet the classification requirements of various applications in the network, and can not be classified accurately. A Markov model network traffic classification algorithm based on semi-supervised learning is proposed. The Markov model is constructed by the correlation between flows. The center of the clustering is estimated by density calculation. The center point is calculated by KL distance. The similarity between samples is divided into different application types. The feature of the Markov model is used to identify the traffic application type and improve the accuracy. The problem of the traditional traffic classification method based on semi-supervised learning depends on the unstable clustering algorithm. Experimental results show that the network traffic classifier can achieve the ideal classification effect.

关 键 词：网络流量分类 马尔科夫模型 相似度计算 半监督学习 流相关性 样本密度 聚类算法 相对熵 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]